# S8 — Shell environment

Re-surveyed **2026-08-07** and re-derived in full at **2026-08-08 02:59:45 UTC** under the amended spec (previous pass 2026-07-25) at full fidelity — every declared enumeration ran, no sudo, no degrade rung, and every row reproduced identically to the earlier snapshot rather than being edited to match. This census records eight rc/profile candidates, the 32 positions configured by a clean login+interactive zsh, and **30** personal-bin entries (was 28). A caller-inherited session presently has more positions than the clean view; its Codex shim, iTerm helper, frontend-design plugin path, and inherited duplicates are real session facts but not deterministic shell configuration, so they remain deliberately narrative-only per `caller_dependent_path_rule`.

**What moved since 2026-07-25: only `~/.local/bin`.** The rc chain and the resolved PATH did not change at all — same eight files, no rc-file mtime later than 2026-07-24, and the 32 PATH positions are byte-identical in order. That is a meaningful negative result for the highest-secret-risk surface on the machine: the cleartext key export has neither moved nor been remediated.

## Changes since the last pass

| Change | What actually happened |
| --- | --- |
| `docker-cache-prune.sh` **removed** | Gone from `~/.local/bin`, and its cross-referenced launchd job went with it — `launchctl print gui/501/tech.thewolf.docker-cache-prune` now returns *Could not find service*. Script and job were retired together, which is the clean way to do it. Cross-check S1. |
| `graphify`, `graphify-mcp` **added** | One `uv tool` install of the PyPI package **graphifyy 0.9.31** on 2026-07-31 08:51, which drops two entry-point symlinks into `~/.local/bin` pointing at `~/.local/share/uv/tools/graphifyy/bin/`. Same day the `graphify` skill appeared under `~/.claude/skills` (see S10) — one install, two surfaces. |
| `rmapi` **added** | An ad-hoc-signed reMarkable-cloud Go CLI (`github.com/juruen/rmapi`). Its mtime is 2026-05-22 but its ctime is 2026-08-06 23:29:56 and it was absent from the 2026-07-25 scan — so it was **copied in with its timestamp preserved**, not built or downloaded fresh. It is the only file in this directory owned `wolf:wheel` instead of `wolf:staff`. |
| `claude` symlink **advanced** | Target moved `2.1.220` → `2.1.225`; the symlink itself was rewritten 2026-08-07 21:24:52 by the CLI's own auto-update. Six versions are now retained under `~/.local/share/claude/versions`. |
| `agy.1786157497599092000.old` **appeared, and is deliberately not counted** | `agy` replaced itself at 2026-08-07 22:51:39 local and renamed its predecessor aside. Per the spec's new `vendor_backup_class` this is a **vendor backup artifact**, not a personal-bin executable — see below. |

## The vendor backup class — one deliberate blind spot

A self-updating CLI does not overwrite its binary; it renames the old one to `<name>.<epoch-nanoseconds>.old` and writes the new one in its place. `agy` does this on every update, and until 2026-08-08 this surface had no concept for such a file, so each one arrived as a novel event: `agy.1784955644514980000.old` was struck from the inventory as a stale phantom on 2026-07-25, and its successor `agy.1786157497599092000.old` failed the gate in the *opposite* direction on 2026-08-08, as an uncounted row, 46 minutes after a clean scan.

Inventorying it would simply re-create the July situation — a row the next update strands. Flagging it `transient` exempts only the disappearance, never the appearance. Two remedies, each half a remedy, applied twice to one signature: that is a failed diagnosis, not bad luck. The spec now excludes the *shape* `<name>.<9-or-more-digits>.old` from both the personal-bin scan and its paired parity probe, so the class is out of scope by definition rather than chased every time. The needle is scoped to the machine-written timestamp on purpose: a human-named `foo.old` or `backup.old` is a real entry here and is still counted.

**One such file was present at this scan and is not itemized.** State the cost plainly: this class is now invisible to the census by design. If a vendor backup were ever the thing that mattered — tampered with, or a hostile file named to match the shape — this surface would not show it, and no other surface owns `~/.local/bin`. That is a real price for a probe that can hold still, and it is recorded here rather than silently subtracted from the count.

## Security read

**The cleartext key is still there.** `~/.zshrc` line 136 still exports `OPENAI_API_KEY`, with the non-secret `OPENAI_BASE_URL` on line 137 showing it is gateway-routed rather than called directly. The name-only grep is the only read this surface performs; no value has ever entered an artifact. Eleven days on, this remains the single highest-value finding in the atlas and it is unremediated.

**`rmapi` is the new flag.** `codesign -dv` reports `Identifier=a.out`, `flags=0x20002(adhoc,linker-signed)`, `Signature=adhoc`, `TeamIdentifier=not set` — an ad-hoc-signed binary with no developer identity, sitting on PATH, whose provenance rests only on Go symbols embedded in the binary (`github.com/juruen/rmapi`). It was not executed. To be precise about the risk: it is mode `755` and **not** world-writable, so this is **not** a privilege-escalation vector — it is an unverified supply chain. The `wolf:wheel` group and the preserved mtime both point at a copy from somewhere else on disk rather than a package-manager install. Worth one question to Wolf: did you put this here on purpose?

**Nothing on PATH is world-writable** — re-verified. The only non-`755` directories are `/opt/homebrew/bin` and `/opt/homebrew/sbin` at `775 wolf:admin`, which is group-writable, not other-writable.

## Self-use answers

1. `.zshrc` exports `OPENAI_API_KEY` at line 136 — **unchanged and still cleartext**. No value was read or recorded. `OPENAI_BASE_URL` at line 137 is a non-secret routing URL indicating gateway routing.
2. The account shell is `/bin/zsh`. `.zshenv`, `/etc/zprofile`, `.zprofile`, `/etc/zshrc`, and `.zshrc` are the active zsh chain. `.profile`, `.bashrc`, and `.bash_profile` are dead for normal zsh startup unless an explicit sh/bash workflow uses them.
3. `~/.local/bin` occurs at positions 2, 7, 25, 28, and 30, from `.zshenv:2`, `.zprofile:5`, `.zprofile:9`, `.zshrc:133`, and `.zshrc:175`. Four separate rc-file lines all prepending or appending the same directory is the whole cause.
4. `~/Projects/Scripts` at position 5 is the Wolf-side missing directory from `.zshrc:135` — still missing. Missing Cryptex, PMK (`/pkg/env/global/bin`), rvictl, and `/usr/ucb` entries are Apple/system conditional bootstrap paths, not a Wolf configuration error.
5. No extant PATH directory is world-writable. Homebrew directories are group-writable (`775`), not world-writable.
6. `~/.local/bin` has **30** entries: 11 Wolf-authored shebang scripts and 19 vendor/tool-installer drops (15 symlinks and four Mach-O binaries). Three header-limited scripts remain `unknown`.
7. Safe cleanup: preserve one local-bin PATH mutation and remove the other four; remove `.zshrc:135`; archive bash/profile files only after explicit-use checks. The `agy` vendor backup (one file, 164,873,872 bytes) is disk hygiene, not a census target — it is excluded by class and will be superseded by the next `agy` update regardless. Replacing the cleartext key requires a safer injection mechanism, not an unplanned deletion.

## Dispositions

- `zshrc` — investigate; migrate its cleartext API-key export. `zprofile` — prune; consolidate Homebrew/local-bin setup. `zshenv` — keep; retain Cargo sourcing while consolidating PATH. `etc-zshrc`, `etc-zprofile` — keep; Apple configuration. `profile`, `bashrc`, `bash-profile` — investigate; confirm explicit shell use before archival.
- `path-01`–`path-04` — keep; Grok, local-bin, Bun, and Conda setup. `path-05` — prune; missing Wolf projects path. `path-06` — keep; Go bin. `path-07` — prune; duplicate local-bin prepend. `path-08`–`path-24` — keep; Homebrew, OS, and application paths, including conditional Apple entries. `path-25` — prune; duplicate local-bin. `path-26` — keep; Cargo. `path-27` — keep; absent Apple bootstrap default. `path-28` — prune; duplicate local-bin append. `path-29` — keep; LM Studio. `path-30` — prune; duplicate local-bin append. `path-31`, `path-32` — keep; Android tools.
- `local-bin-install-codex-sh`, `local-bin-install-opencode-sh`, `local-bin-install-git-sh`, `local-bin-install-gemini-sh`, `local-bin-install-claude-code-sh`, `local-bin-chatcode-update-agent-clis`, `local-bin-chatcode-claude-hook`, `local-bin-chatcode-gateway` — keep; documented Chatcode helpers.
- `local-bin-uvx`, `local-bin-hb`, `local-bin-pipenv`, `local-bin-harbor`, `local-bin-yt-dlp`, `local-bin-pipenv-resolver`, `local-bin-claude`, `local-bin-agent`, `local-bin-grok`, `local-bin-stb`, `local-bin-uv`, `local-bin-poetry`, `local-bin-agy`, `local-bin-snk`, `local-bin-hr`, `local-bin-shodan` — keep; vendor tools.
- `local-bin-graphify`, `local-bin-graphify-mcp` — keep; one deliberate uv tool install backing the `graphify` skill. Removing either without `uv tool uninstall graphifyy` leaves an orphaned tool tree.
- `local-bin-rmapi` — **investigate**; ad-hoc-signed, no developer identity, arrived by mtime-preserving copy, group `wheel`. Confirm deliberate installation before treating it as keep.
- `local-bin-agent-common-sh`, `local-bin-chatcode-maintenance`, `local-bin-chatcode-notify` — investigate; their allowed five-line headers did not establish purpose.
- `local-bin-docker-cache-prune-sh` — **retired**; row removed this pass. Script and its launchd job are both gone from the machine.